Some network communication analysis applications analyze network traffic in order to reconstruct network sessions conducted by certain network users. Such analysis may be performed for various reasons, such as network forensics, employee training, data leakage prevention (DLP) and tool testing. For example, Fox-IT (Delft, The Netherlands) offer a system called FoxReplay Analyst, which reconstructs Internet sessions of target users from intercepted Internet packets. The system is described in a white paper entitled “FoxReplay Analyst,” Revision 1.0, November, 2007, which is incorporated herein by reference.